← RETURN TO CITADEL
♜ CLOUDFLARE TUNNEL
PUBLIC ACCESS · ZERO PORT FORWARDING · SYSTEMD SERVICE · SECURE ROUTING
STATUS: ACTIVE
PROJECT OVERVIEW
The Cloudflare Tunnel project provides public access to The Citadel without traditional
router port forwarding. Instead of exposing inbound ports directly to the internet,
the Ubuntu host maintains an outbound tunnel connection to Cloudflare.
This allows rootandrook.com to reach the Citadel platform while keeping the local network
architecture cleaner and reducing direct exposure of the home lab environment.
TRAFFIC FLOW
Visitor
↓
rootandrook.com
↓
Cloudflare Edge
↓
Cloudflare Tunnel
↓
Ubuntu Host
↓
Apache on Port 80
↓
The Citadel Website
CURRENT CONFIGURATION
- Cloudflare Tunnel is configured and operational.
- Tunnel name: citadel-tunnel.
- Cloudflared is installed and managed through the APT package manager.
- Cloudflared runs as a systemd service.
- The service is enabled at boot.
- Apache serves The Citadel on port 80.
- Cloudflare forwards public traffic to the local Apache frontend.
SECURITY VALUE
Cloudflare Tunnel avoids traditional inbound router port forwarding while still allowing
the Citadel platform to be publicly accessible. This creates a cleaner exposure model for
a home lab and places Cloudflare in front of the public endpoint.
COMMAND AREAS PRACTICED
cloudflared tunnel list
systemctl status cloudflared --no-pager
cloudflared version
apt policy cloudflared
sudo apt update
sudo apt install cloudflared
MAINTENANCE ACTIVITY
- Verified cloudflared version through package manager.
- Confirmed installed version and available candidate version.
- Updated cloudflared using APT instead of the built-in updater.
- Confirmed the cloudflared service remained active after update.
- Validated public connectivity after service restart.
LESSONS LEARNED
- Cloudflare Tunnel can publish local services without router port forwarding.
- Systemd keeps cloudflared running persistently across reboots.
- Package-managed software should be updated through its package manager.
- Changing the frontend architecture requires careful routing validation.
- Public routing, local services, and document roots must stay aligned.
NEXT OBJECTIVES
- Create a formal architecture diagram for public traffic flow.
- Document recovery steps for rebuilding the tunnel on a new VM.
- Clarify Apache routing for Citadel, Odysseus, Argus, and Sentinel.
- Evaluate whether future modules should be routed by Apache or containerized behind it.